CVE-2026-41940: The cPanel Zero-Day That Sat Unpatched for Two Months

Mon, 04 May 2026 00:00:00 +0000

On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940 — a CVSS 9.8 authentication bypass that, as it turned out, attackers had been quietly exploiting since approximately February 23. That is roughly two months of zero-day exposure across an estimated 1.5 million internet-facing cPanel & WHM instances. CISA promptly added it to its Known Exploited Vulnerabilities catalog, which is the agency’s way of saying: stop reading and go patch.

Whm on kalfaoglu.net

CVE-2026-41940: The cPanel Zero-Day That Sat Unpatched for Two Months